re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)

CVE-2026-67550

## Summary `re2` validates the user-settable `lastIndex` against the subject's **UTF-8 byte length** but then uses it a

历史摘要 · 未重新核验 · GitHub Advisory

re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

CVE-2026-68499

## Summary `String.prototype.match` with a **global** `RE2` collects all matches in a native loop that advances the cur

历史摘要 · 未重新核验 · GitHub Advisory

`nx graph` dev server permissive CORS policy

CVE-2026-54753

## Summary The local HTTP server started by `nx graph` sent `Access-Control-Allow-Origin: *` on every response, letting

历史摘要 · 未重新核验 · GitHub Advisory

`@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation

### Summary `@dynatrace-oss/dynatrace-mcp-server` v1.8.5 exposes an HTTP transport mode (`--http` flag) that performs n

历史摘要 · 未重新核验 · GitHub Advisory

@dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification

### Summary A template injection vulnerability in the `create_workflow_for_notification` tool lets a caller embed Jinja2

历史摘要 · 未重新核验 · GitHub Advisory

mathlive's Lack of Escaping of HTML allows for XSS

CVE-2026-54705

### Summary Despite the 0.104.0 patch escaping attribute-bearing constructs (`\htmlData`, `\href`), text-content reflec

历史摘要 · 未重新核验 · GitHub Advisory

AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping

CVE-2026-11393

### Summary The AgentCore CLI (@aws/agentcore) is a developer tool for managing agent infrastructure lifecycle on Amazon

历史摘要 · 未重新核验 · GitHub Advisory

@dynatrace-oss/dynatrace-mcp-server's create_dynatrace_notebook missing the human-approval gate

### Summary A missing human-approval gate on the `create_dynatrace_notebook` tool allows a caller to create persistent t

历史摘要 · 未重新核验 · GitHub Advisory

swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies

CVE-2026-54666

### Summary `swagger-typescript-api` interpolates OpenAPI path strings (the keys of the `paths` object, e.g. `/users/{i

历史摘要 · 未重新核验 · GitHub Advisory

swagger-typescript-api vulnerable to code injection via unescaped enum string values

CVE-2026-54664

### Summary `swagger-typescript-api` interpolates `components.schemas.*.enum[i]` string values into the body of generat

历史摘要 · 未重新核验 · GitHub Advisory

Style Dictionary - Prototype Pollution in convertTokenData utility function

CVE-2026-54639

### Impact Prototype pollution. A malicious user can create a token array `[{ key: '{__proto__.foo}', value: 'malicious'

历史摘要 · 未重新核验 · GitHub Advisory

@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

CVE-2026-54658

### Impact A SQL injection vulnerability exists in the `escapeValue()` function used for parameter substitution. Attack

历史摘要 · 未重新核验 · GitHub Advisory

NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass

CVE-2026-52888

# Security Vulnerability Report: Sensitive Data Exposure via SQL Blacklist Bypass ## Summary The `checkSQL()` function

历史摘要 · 未重新核验 · GitHub Advisory

FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller

## Summary The OpenAPI adapter's spec-change **poller** (`OpenApiSpecPoller`) re-fetched the configured spec `url` on a

历史摘要 · 未重新核验 · GitHub Advisory

Quasar: Prototype pollution in the extend() utility

### Summary `quasar@2.20.1`, the latest published version at the time of testing, appears to be vulnerable to prototype

历史摘要 · 未重新核验 · GitHub Advisory

Shescape: Quadratic-time denial of service in the flag-protection

### Impact This impacts users of Shescape that have flag protection enabled, which is on by default, regardless of the

历史摘要 · 未重新核验 · GitHub Advisory

Shescape: Home-directory disclosure in assignment context on Unix with Dash

### Impact This impacts users of Shescape on Unix systems that explicitly configure `shell` to Dash, or `true` when the

历史摘要 · 未重新核验 · GitHub Advisory

Shescape: Shell injection via unescaped parentheses on Windows with CMD

### Impact This impacts users of Shescape on Windows that explicitly configure `shell` to CMD, or `true` with the defau

历史摘要 · 未重新核验 · GitHub Advisory

Shescape: Path disclosure on Unix with Zsh

### Impact This impacts users of Shescape on Unix systems that explicitly configure `shell` to Zsh, or `true` when the

历史摘要 · 未重新核验 · GitHub Advisory

brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

CVE-2026-14257

### Summary `expand()` bounds the *number* of results it produces (the `max` option, `100_000` by default) but not thei

历史摘要 · 未重新核验 · GitHub Advisory